EN PT-BR
← Voltar ao feed
high government

Turla's Cereal toolset turns government Exchange servers into email-collection and C2 hubs

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 11:30 · coletado há 1 hora

Turla, a Russia-aligned group that ESET attributes to the FSB with high confidence, has deployed a previously undocumented .NET toolset called Cereal on Microsoft Exchange Server environments of two government organisations, one in Kazakhstan and one in Romania. In Romania, the email collection module was set to copy messages sent to or from NATO and EU addresses. The toolset needs no attacker-owned command server: the compromised Exchange server itself serves as C2, and ESET saw no external infrastructure or operator IP addresses (welivesecurity.com; bleepingcomputer.com). ESET has not explained how the initial access was gained, and no Exchange vulnerability or CVE is named in its research, so the activity is post-compromise espionage (cybersecuritynews.com). Defenders should treat any government Exchange server as a potential collection point and hunt for the Cereal components.

Detalhes técnicos

  • The toolset is modular: CerealLoader, CerealRunner, CerealNeuron, CerealBox and CerealHermit (cyberpress.org; welivesecurity.com). CerealNeuron is the passive main backdoor. It listens for web requests on paths that resemble Outlook Web Access, Autodiscover and ActiveSync, so the traffic looks like ordinary mail use (cyberpress.org; helpnetsecurity.com).
  • Operators send each command as a small, separately compiled .NET program carried in encrypted containers and run in memory. The sheer number of near-identical binaries suggests an internal build framework (welivesecurity.com; bleepingcomputer.com). Observed tasks include retrieving email, querying Active Directory, extracting locally stored credentials, and reading or deleting files (bleepingcomputer.com).
  • CerealBox is the email collection module. It runs inside EdgeTransport.exe, the Exchange transport process, and hooks the mail pipeline from the inside. ESET says no malware family has documented this technique before (welivesecurity.com; helpnetsecurity.com). No new transport agent appears in the Exchange configuration, and the original message keeps flowing (helpnetsecurity.com).
  • Collection is selective. CerealBox picks messages with DOC, DOCX or PDF attachments that match configured senders, recipients, subject text or attachment names, and runs its logic before normal delivery resumes (cyberpress.org). Selected messages are compressed, encrypted and staged on the server until operators retrieve and delete them (gbhackers.com; cybersecuritynews.com).
  • CerealHermit is a second backdoor that reads encrypted commands from disk rather than from the network (cybersecuritynews.com; cyberpress.org).
  • Attribution rests on the concurrent use of another component publicly linked to Turla and on similarities with older Turla tools, including the Exchange backdoor LightNeuron (mlq.ai; gbhackers.com).

Remediação

  • ESET's white paper and its GitHub repository publish a list of indicators of compromise (welivesecurity.com; bleepingcomputer.com). The article itself lists none, so none are recorded here. Analysts should pull that list and check Exchange servers against it.
  • No vendor fix applies, because the activity depends on existing server access rather than a flaw in Exchange (cybersecuritynews.com). Analyst recommendation: review EdgeTransport.exe for unexpected injected code and review web-facing Exchange request logs for unusual encrypted requests.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 10/11/2026 11:30 · coletado 10/11 12:00 primeiro registro

    Turla's Cereal toolset turns government Exchange servers into email-collection and C2 hubs

    ler a análise desta fonte

    Turla, a Russia-aligned group that ESET attributes to the FSB with high confidence, has deployed a previously undocumented .NET toolset called Cereal on Microsoft Exchange Server environments of two government organisations, one in Kazakhstan and one in Romania. In Romania, the email collection module was set to copy messages sent to or from NATO and EU addresses. The toolset needs no attacker-owned command server: the compromised Exchange server itself serves as C2, and ESET saw no external infrastructure or operator IP addresses (welivesecurity.com; bleepingcomputer.com). ESET has not explained how the initial access was gained, and no Exchange vulnerability or CVE is named in its research, so the activity is post-compromise espionage (cybersecuritynews.com). Defenders should treat any government Exchange server as a potential collection point and hunt for the Cereal components.

    Technical Details

    • The toolset is modular: CerealLoader, CerealRunner, CerealNeuron, CerealBox and CerealHermit (cyberpress.org; welivesecurity.com). CerealNeuron is the passive main backdoor. It listens for web requests on paths that resemble Outlook Web Access, Autodiscover and ActiveSync, so the traffic looks like ordinary mail use (cyberpress.org; helpnetsecurity.com).
    • Operators send each command as a small, separately compiled .NET program carried in encrypted containers and run in memory. The sheer number of near-identical binaries suggests an internal build framework (welivesecurity.com; bleepingcomputer.com). Observed tasks include retrieving email, querying Active Directory, extracting locally stored credentials, and reading or deleting files (bleepingcomputer.com).
    • CerealBox is the email collection module. It runs inside EdgeTransport.exe, the Exchange transport process, and hooks the mail pipeline from the inside. ESET says no malware family has documented this technique before (welivesecurity.com; helpnetsecurity.com). No new transport agent appears in the Exchange configuration, and the original message keeps flowing (helpnetsecurity.com).
    • Collection is selective. CerealBox picks messages with DOC, DOCX or PDF attachments that match configured senders, recipients, subject text or attachment names, and runs its logic before normal delivery resumes (cyberpress.org). Selected messages are compressed, encrypted and staged on the server until operators retrieve and delete them (gbhackers.com; cybersecuritynews.com).
    • CerealHermit is a second backdoor that reads encrypted commands from disk rather than from the network (cybersecuritynews.com; cyberpress.org).
    • Attribution rests on the concurrent use of another component publicly linked to Turla and on similarities with older Turla tools, including the Exchange backdoor LightNeuron (mlq.ai; gbhackers.com).

    Remediation

    • ESET's white paper and its GitHub repository publish a list of indicators of compromise (welivesecurity.com; bleepingcomputer.com). The article itself lists none, so none are recorded here. Analysts should pull that list and check Exchange servers against it.
    • No vendor fix applies, because the activity depends on existing server access rather than a flaw in Exchange (cybersecuritynews.com). Analyst recommendation: review EdgeTransport.exe for unexpected injected code and review web-facing Exchange request logs for unusual encrypted requests.